Hey everybody and welcome to the next video.
We're going to be looking at DNS in this video.
Now we're going to go over a few tools and then kind of how to do this manually.
So the first tool I want to introduce you to is DNS recon.
So DNS to make this a little bigger as recon.
All right.
So DNS recon can provide you a lot of information around what the server owns whether we're doing a
zone transfer so a zone transfer for DNS is essentially it's you're asking for an entire copy of everything
on the DNS server.
So every host every IP that's associated with it everything.
And if DNS servers from this configured it'll provide all this information which will give the attacker
a much bigger advantage about seeing the full scope of an enterprise and what they have set up.
So if we run DNS recon and we give it the dash for domain new team nation dot com
d and s we can.
So what this is gonna do is we're gonna see a few things.
So Dina SEC has been not configured.
That's that's fine.
So we see our name servers that we're using are a record and our Amex record for mail are a record for
Red Team nation dot com.
And then our techs record which is an SPF record for it looks like market hero which is fine.
We'd expect all that at least for this particular domain.
And then Savi records we're seeing something for CIP and more for it.
So this gives us a good idea of what DNS or no DNS servers are available and what are Dina's records
are actually set.
Now there's another tool called DNS enum now DNS name provides a little bit more.
So what we're gonna do is we're going to dash dash enum and this provides us this look up here it's
a shortcut for the equivalent of giving us five threads and a dash s which is right here for a limited
number of subdomains they'll be scraped from Google as 15 and then we have dash W which is performing
a who is right we do team nation dot com with our dash know what we're seeing here is a lot of red.
So we see the host address.
We've gotten the host Direct which is a once 1 0 7 1 83 about 21.
We've got our two DNS servers.
We've got our Amex record.
And it's also trying to do a zone transfer which we talked about already and it's getting buying versions.
So if the server was or the DNS server was running binds on itself it would tell us what the version
is because there are certain vulnerabilities that are vulnerable or available on lower versions of BIND
servers now bind is just Linux as DNS server that you can run.
So it looks like it was it failed because it had it got a corrupted packet back which is fine.
That means it's not expecting to it's not wanting to respond that way.
However all we've done is we've found out some basic information which can allow us to enumerate further.
But another key importance of DNS is our forward look ups which is our standard lookups from hostname
to IP but also reverse lookups which is IP to hostname.
So to do a forward look up we would do host dash T A which tells us to get the type of record that we're
looking for which is a record which is our standard domain record.
So a team well actually we'll do Facebook Facebook dot com post dash t a Facebook.
So if we look here Facebook dot com has an address of this.
That's perfect.
Now what I want you to notice here is that we could script this very easily.
So if we did host dash T A We wanted to find out what domains Facebook owns.
As an example so a subdomain is you know domain dot the the real domain.
Right.
So right now if we did test let's say just to see if test work.
So if we do test looks like it was not founded we have a very specific output for when something is
not found.
But if we do w w w dot which is r which is an actual subdomain we can see it's an alias for this star
many C1 C 10 our Facebook account which has an address of what we expected.
That's pretty cool.
Now let's look at maybe dot dot Facebook so we can see in turn in turn dash regional dot BBB dot Facebook
dot com.
So we can tell that Deb that Facebook is everyone's so you can put this to a wordless and just have
it scraped through and run this command with this changing every time.
And if it finds isn't is an alias for its founder it's found a valid domain if it finds not found then
it has not.
So it's a good way to loop through and find out all the subdomains that may be owned by an organization
which there might be subdomains that have for example this Dev.
I highly doubt it for Facebook.
However for other organizations maybe dev is a complete is a completely development version of the site
that that might be running on an internal server.
And if that's the case you might go to find vulnerabilities that weren't present in the real version.
But they are Dev version and there might be a thousand other reasons for that.
However if we take the same IP let's say we're running it based on IP range and not on hostname.
So what we can do is we can do C and s look up actually was doing this and then our IP
so if we look here we can see that this resolves to edge star mini Shiv a CV H S HB 01 SJC 3 def Facebook
dot com which tells me this is one of their edge servers that they have in there.
The Edge part of their database or their data center.
So this is what we're hitting every time we go through and now it's staying the same right now.
However it might change later.
So we'll just to three outside calling the same region.
So you can see slightly different edge server but it's in there same region.
So are there same net block that they own.
We brought this up to 3 0 7 it's probably another one of them.
So this is an Instagram edge server for Facebook.
So it's important to be able to understand how to do a forward DNS lookup which is just host teed Ashleigh
and then the hostname and then a reverse lookup with N.S. look up on the local database or on the IP
address instead.
So you can script these and what I want you guys to do in this particular video is use python and script
out running this command create a bunch of these.
So w w w dot dev test admin debug just grab a few different names mail and put them in a word list or
in a list in Python.
And then I want you to run through and run this command if it finds the string is an alias for I want
you to print that it's a valid domain name or it's it's a valid subdomain and then do and have it run
and look up and have it see if there is a valid name for this or not on the vice versa through a network.
BLOCK actually we'll remove the reverse lookup we're gonna leave that out of there because I don't want
you guys to run through Facebook s entire network.
BLOCK however you can do the work you can do the standard forward lookups with what the with the python
script and you can see if you find not found it obviously was not found at all.
So go ahead and run that script.
Don't do too many and do like 10 or 20 tops and then you'll get a better idea of kind of what you could
look at if if they had been a potential target.